Method and System for Dynamic Network Intrusion Monitoring, Detection and Response

Abstract

A probe attached to a customer's network collects status data and other audit information from monitored components of the network, looking for footprints or evidence of unauthorized intrusions or attacks. The probe filters and analyzes the collected data to identify potentially security-related events happening on the network. Identified events are transmitted to a human analyst for problem resolution. The analyst has access to a variety of databases (including security intelligence databases containing information about known vulnerabilities of particular network products and characteristics of various hacker tools, and problem resolution databases containing information relevant to possible approaches or solutions) to aid in problem resolution. The analyst may follow a predetermined escalation procedure in the event he or she is unable to resolve the problem without assistance from others. Various customer personnel can be alerted in a variety of ways depending on the nature of the problem and the status of its resolution. Feedback from problem resolution efforts can be used to update the knowledge base available to analysts for future attacks and to update the filtering and analysis capabilities of the probe and other systems.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS [0001] This application is a continuation application of and claims priority from U.S. Non-Provisional patent application Ser. No. 09 / 766,343 filed Jan. 19, 2001 (Attorney Docket No. 022133-000510US) which claims priority from and is a non-provisional of U.S. Provisional Patent Application No. 60 / 190,326, filed Mar. 16, 2000 (Attorney Docket No. 022133-000500US), the entire disclosures of these applications are incorporated herein by reference for all purposes.FIELD OF THE INVENTION [0002] This invention relates generally to network security and, more specifically, to methods and systems for dynamic network intrusion monitoring, detection and response. BACKGROUND OF THE INVENTION [0003] Most computer and network security products focus on prevention. Firewalls prevent unauthorized traffic from entering a company's internal network; authentication mechanisms prevent unauthorized persons from logging on to a company's computers; and encryption p...

AI Technical Summary

Benefits of technology

"The patent text describes a system for managing and prioritizing requests and diagnostics from customers. The system uses various fields to describe the nature of the request or diagnosis, and includes a memo diary to keep track of relevant notes and attachments. The system also allows for the creation of a summary of the diagnosis and its impact on the customer. The technical effect of this system is to improve the efficiency and accuracy of managing customer requests and diagnostics, and to provide a better service to customers."

Problems solved by technology

But because such products cannot be relied upon to work perfectly, and because security bugs may exist in other software or hardware, complete network security also requires monitoring, detection and response in the event of a breach.

System administrators normally do not have the time or ability to read through large amounts of constantly updated audit information, looking for attacks on their systems.

They also do not have the time to continuously monitor hacker activities, looking out for new tactics, tools and trends.

Finally, they do not have the time to become experts on every kind of intrusion and to maintain that expertise.

Images